fix(cli): use shell-neutral guidance for overriding API key variables

[rohanpoudel2]

Fixes #33

Problem

When an API-key environment variable overrides a stored ChatGPT sign-in, the CLI suggests unset, which PowerShell does not provide. Windows users are told to run a command that does not exist, precisely when they are trying to resolve credential precedence.

There are two call sites in src/cli.ts, both reported in #33:

1. login status, which always names both variables:

   To use a ChatGPT sign-in, unset OPENAI_API_KEY and CODEX_API_KEY.

2. the login warning that a configured environment API key will keep taking precedence, which names only the variables actually set:

   To use a stored ChatGPT sign-in, pass '--auth chatgpt' or run 'unset OPENAI_API_KEY'.

Change

Both messages now use shell-neutral wording, following the direction suggested in the issue:

To use a ChatGPT sign-in, remove OPENAI_API_KEY and CODEX_API_KEY from the environment, then run the command again.

To use a stored ChatGPT sign-in, pass '--auth chatgpt' or remove OPENAI_API_KEY from the environment, then run the command again.

The second message builds its variable list at runtime and can name either one or both variables, so the separator changed from " " to " and ". That set has at most two members, so this reads correctly in both cases without needing a general list formatter. Variable-name casing is passed through unchanged, as before.

Verification

• The three existing assertions on the old wording in tests-ts/cli-authentication.test.ts are updated.
• A new regression test, uses shell-neutral guidance when an API key overrides the stored login, asserts that stderr from login status and from login (with one and with two variables set) never matches /\bunset\b/, /\bexport\s+\w+=/, or /\$env:/i, so this cannot silently regress into any single-shell dialect.

 718 pass
 5 skip
 0 fail

pnpm run types and pnpm run format are clean.

Left alone deliberately

• src/api.ts already spells out both POSIX and PowerShell ($env:) forms, so it needs no change.
• The #!/bin/sh wrapper the CLI generates is a real POSIX script, not user-facing shell advice.
• README.md and sdk/typescript/README.md show unset OPENAI_API_KEY CODEX_API_KEY inside an explicitly labelled bash fence. A labelled shell example is not the same defect as the CLI assuming a shell, so it is out of scope here; happy to follow up if you would like the docs to show both shells.